There are several pitfalls when using the default mappings for logs (the logs-*-* index template):

• Data loss
  • Mapping issues due to object vs scalar conflicts ("host": "foo", "host.name": "foo")
  • Mapping issues due to conflicting types ("foo": 42, "foo": "bar")
  • Mapping explosions
• Ingestion and disk overhead because all fields are indexed by default, even for fields that are never or rarely searched by (for example process.argv)